Patent attributes
Disclosed herein are system, method, and computer program product embodiments for providing traffic visibility in a network. An embodiment operates by a third-party component in communication with a network component—each located at a network's edge—maintaining a rule table including a first rule comprising first identifiers and a first action for deriving a first packet characteristic. The third-party component receives a first packet copy including second identifiers from the network component. Upon the second identifiers matching the first identifiers, the third-party component determines the rule table's second rule includes a second action for deriving a second packet characteristic. Thereafter, the third-party component receives a second packet copy comprising third identifiers from the network component. Upon the third identifiers matching the first identifiers, the third-party component identifies the rule table's second rule and performs the second rule to derive the second packet characteristic based on the second packet's data.